JWT Decoder

Decode a JSON Web Token's header and payload and read its security warnings. Supply a key and the tool verifies the signature too.

This is generated in browser and is not sent to pah.moi servers.

The JWT tool needs JavaScript to work in your browser. It is client-only. The jwt-cli command is the offline equivalent: jwt-cli inspect, jwt-cli verify and jwt-cli construct.

About this tool3 paragraphs

Verification covers HS*, RS*, PS*, ES* and EdDSA against a secret, PEM public key, JWK or JWKS you supply, and the claim validation reads exp, nbf, iat, issuer and audience with a documented clock skew. Expert mode builds demo tokens and drops them back into the inspector.

A verified signature proves who signed a token, not that the token should be trusted: the banner says VERIFIED, never safe.

A JWT is a bearer credential, so the tool is gated behind a short acknowledgement. Your token, secret and keys never leave the browser and nothing here is logged.

Use it locally This tool has a native command line twin. Build jwt-cli from the site's source with:

cargo build --release --bin jwt-cli

Source and licence terms